diff --git a/debian/README.Debian b/debian/README.Debian index 505b9dd6..c4707972 100644 --- a/debian/README.Debian +++ b/debian/README.Debian @@ -77,21 +77,16 @@ port = ssh protocol = tcp -* Multiport banning: Comment for the wishlist #373592. +* Multiport banning: Comment for #373592, #545971 -Default iptables rules for banning use --dport statement which allows -to ban just a single port. For multiport banning you would need to use -iptables-multiport action (just override banaction in jail.local), -which is present in fail2ban shipped in Debian since 0.7.6-1. +iptables-multiport action is now default banaction (file jail.conf, to +be customized within jail.local). Therefore assure that you have built +multiport module if you use custom kernel. If you would like to ban all ports for that host, just redefine fwban/fwunban commands to don't have --dport %(port)s statement at all, or use shorewall, where actionban bans whole IP. -iptables-multiport action is not default banaction since multiport -module might not be compiled for some hand compiled kernels. - - * Blocking of NEW connections only Comment for the wishlist #350746. diff --git a/debian/control b/debian/control index 216434ae..9fee2855 100644 --- a/debian/control +++ b/debian/control @@ -8,7 +8,7 @@ XS-Python-Version: current, >= 2.4 Homepage: http://www.fail2ban.org Vcs-Browser: http://git.onerussian.com/?p=deb/fail2ban.git Vcs-git: git://git.onerussian.com/deb/fail2ban.git -Standards-Version: 3.8.2 +Standards-Version: 3.8.3 Package: fail2ban diff --git a/debian/fail2ban.logrotate b/debian/fail2ban.logrotate index e3a9ab8a..78137684 100644 --- a/debian/fail2ban.logrotate +++ b/debian/fail2ban.logrotate @@ -7,7 +7,7 @@ delaycompress missingok postrotate - invoke-rc.d --quiet fail2ban reload >/dev/null + fail2ban-client set logtarget /var/log/fail2ban.log >/dev/null endscript create 640 root adm } diff --git a/files/logs/proftpd b/files/logs/proftpd new file mode 100644 index 00000000..def8a83e --- /dev/null +++ b/files/logs/proftpd @@ -0,0 +1,5 @@ +Jan 10 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username (Login failed): User in /etc/ftpusers +Feb 1 00:00:00 myhost proftpd[12345] myhost.domain.com (123.123.123.123[123.123.123.123]): USER username: no such user found from 123.123.123.123 [123.123.123.123] to 234.234.234.234:21 + + + diff --git a/files/logs/pure-ftpd b/files/logs/pure-ftpd new file mode 100644 index 00000000..4b4e3455 --- /dev/null +++ b/files/logs/pure-ftpd @@ -0,0 +1,2 @@ +Jan 31 16:54:07 desktop pure-ftpd: (?@24.79.92.194) [WARNING] Authentication failed for user [Administrator] +Nov 5 18:54:02 pure-ftpd: (?@server202181210195.ixlink.net) [WARNING] Authentication failed for user [Administrator]